I have Windows XP service pack 2
Dimension 2400 Dell
I get an error message as follows:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 7/14/2006
Time: 7:43:36 AM
User: N/A
Computer:
Description:
The following boot-start or system-start driver(s) failed to load:
Klif
-------
I get another error message:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 7/14/2006
Time: 7:43:36 AM
User: N/A
Computer:
Description:
The KAV Monitor Service service failed to start due to the following error:
The system cannot find the path specified.
---------------
I looked through the internet, and found the information pasted in below from this site. My question: is the klif driver ONLY for that anti-virus program? If so, I can get rid of it. I have uninstalled and deleted some anti-spyware and anti-virus programs, but I know that bits are still left of at least one of these. I'm wondering if these files are it.
--------------------------
Additional info.: I have searched in several ways for both KAV and Klif. Using the SC find service method in the command module, I was informed that KAV Monitor Service was not an installed service, no surprise.

Now I'm wondering if there is something in the registry. I've used Registry Cleaner Optimizer but it does not find anything out of wack.

Orange Blossom
-------------------------------
Name: klif
Filename: klif.sys
Command: C:\WINDOWS\system32\drivers\klif.sys
Description: Driver used by the Kaspersky Anti-Virus.
File Location: C:\WINDOWS\system32\drivers\klif.sys
Startup Type: This startup entry is installed as a Windows NT, 2000, 2003, or XP service.
Service Name: klif
Service Display Name: klif
HijackThis Category: O23 Entry

have u uninstalled kaspersky completely??? it sounds like its running a boot service...and something went wrong so its messing up your booting..

did u even have kaspersky?
ok well i'm officially confused cuz its saying its a service...but was it an add on service... ok well i think wat i posted above is right if its not sorry

Yes, I did have Kaspersky for a while: just a few days. I was trying out different programs last year. I turned off the program and uninstalled through Add - Remove programs. I knew at the time that this process at times resulted in an incomplete uninstall, so I searched for all the files and folders associated with the program using Search and deleted and erased them completely beyond DoD standards.

I did the same thing for Counterspy, put out by SunBelt. This is the program that has been starting up a bit then quitting. Oddly, I do not get error messages related to this program. Earlier today I discovered a folder of registration keys under SunBelt. I have also just now found a folder of registration keys under Kaspersky.

So how does one completely uninstall a program so this kind of thing does not happen? Is it safe to remove the Kaspersky registration keys?

Orange Blossom

Correction: It was CyberScrub AntiVirus which used the Kaspersky drives etc. It has been over a year since I uninstalled and deleted the program.

yea it is...lemme ask u this..its probly a boot process so be4 u deleted anything did u end all processes related to it in task manager and taks bar??

I stopped the processes in the task bar, but I didn't in the task manager not knowing how to use it at the time. Apparently some parts of the program that would start up automatically weren't shut down and obviously weren't uninstalled or deleted.

Remaining problems at this time: the KAVMonitoringservice. This tries to start when windows starts, and of course cannot. There are at least three very similar registration keys related to this service in the H Keys Local Machine. Some of them have LEGACY as part of the name: e.g. Root/Legacy_KAVMONITORSERVICE/OOOO The slashes go in the other direction of course. I've been searching elsewhere, and apparently some folks ran into a similar problem when installing the next version of Kaspersky Antivirus, as opposed to Cyberscrub. I have not been able to get rid of the registration keys. The system won't let me. KAV Monitor Service also shows up in the local services under the services and applications area. I have just now disabled it using the properties box. I wonder if this will help in getting rid of it.

I'm still left with the question of how to get rid of it.

I have solved the Klif driver problem and I do not get that error message anymore. I was able to delete the driver in the managing devices area.

I have successfully gotten rid of all the Counterspy stuff including the registration keys.

Orange Blossom

p.s. I've noticed other registration keys from yet another software program, AVG7.0 I'd gotten rid of - and I can't get rid of those registration keys either. Fortunately, there are no error messages related to it that I can tell.

lol im no good with registry and looks like i wont be getting kaspersky lawl

I suggest you post a HijackThis log for examination.
A member of the HijackThis Team will walk you through, step by step, how to disinfect your computer.
Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system.

Read Preparation Guide for use before posting a HijackThis Log.
http://www.bleepingcomputer.com/forums/topic34773.html

Please read, and follow, all directions carefully!!!

Then, run a log, and post it in the HijackThis forum, at this link below.
http://www.bleepingcomputer.com/forums/forum22.html Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
It may take a while to get a response, because the HJT Team are very busy. Please, be patient, as these people are volunteers. They will help you out, as soon as possible.

NOTE:

Once you have made the post, please, DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, there will be 1 reply. The team member, glancing over the replies, might assume someone is already helping you out, and will not respond. So, just make your post, and let it sit there, until a team member responds. This way you will be taken care of, in the most timely manner.

You can also use Startup Inspector to stop them from starting with Windows.

Startup Inspector
And
Startup Monitor

http://www.windowsstartup.com/download.php

I'll do the "Hijack this log" sometime tonight or tomorrow after I read all the instructions.

Thanks!

Orange Blossom
---------
Quoting ThorXP

"Once you post your log, don't make any changes to your system, as that could change the results of the posted log, making it difficult to properly clean your system."
----------
I run Spybot, AdAware SE Plus, on a regular basis to remove tracking information including logs in addition to searching for adaware, spyware and cookies. Should I not do some of this after doing the HiJack this log?

Orange Blossom